Agent marketplaces will be won by trust infrastructure, not catalog size

When an autonomous AI agent initiates a payment, it breaks the foundational assumption of every existing payment system: that a human is present on a trusted surface, clicking "buy." This single observation explains why agent marketplaces — two-sided platforms where capability providers publish agents and capability consumers subscribe to them — will be won by whoever solves the trust infrastructure first, not by whoever accumulates the largest catalog of agents.

The trust problem decomposes into three questions, the "three A's" of agentic payments. Authorization: did the user grant this purchase, and under what constraints? Authenticity: does the agent's request reflect true human intent, or is it a hallucinated cart or prompt injection attack? Accountability: when the transaction goes wrong, who is liable — the capability provider who published the agent, the platform that hosted it, or the enterprise that deployed it? Current payment infrastructure assumes human-present flows. Agent marketplaces require human-not-present flows with cryptographic proof of delegated authority.

Google's AP2 (Agent Payments Protocol) addresses this with the mandate model. An intent mandate captures user intent and rules of engagement in a cryptographically-signed proof. A cart mandate records the exact items and price, signed to prevent hallucinated-cart attacks. Together with a delegated payment credential (a pre-authorized payment token), these mandates form an evidence chain: intent → cart → payment, non-repudiable at each step. AP2 is payment-agnostic — it works with cards, stablecoins, and bank transfers — and it's partnered with 60+ networks, processors, and crypto providers. The key insight: you don't solve trust at payment time. You solve it at instruction time, when the human delegates authority to the agent.

OpenAI and Stripe's ACP (Agentic Commerce Protocol) takes a different approach: in-surface checkout that keeps the human in the loop for high-stakes purchases. ACP defines five merchant REST endpoints for checkout session lifecycle management, with authoritative cart state living at the merchant (not the agent, preventing hallucination). Order webhooks synchronize state, and idempotency keys prevent duplicate charges on retry. The delegated payment spec — implemented first as Stripe's Shared Payment Token — lets agents share scoped payment details with PSPs without exposing full card numbers. The merchant of record remains the human's employer, not OpenAI, deliberately avoiding liability assumption. PCI scope is minimized by design: network tokens replace FPANs, and the agent never touches raw card data.

Coinbase's x402 protocol revives the dormant HTTP 402 Payment Required status code for machine-native payments. The flow: request → 402 response with payment details → signed payment → resource delivery. Payment headers (PAYMENT-REQUIRED, PAYMENT-SIGNATURE) carry the cryptographic proof. A facilitator (hosted by Coinbase CDP or third parties) verifies and settles without blockchain infrastructure, charging zero protocol fees — only network fees. The x402 Foundation, now under Linux Foundation stewardship, ensures vendor-neutral governance. The insight here: HTTP is the universal agent interface, so payments should be HTTP-native, not bolted on via checkout redirects.

Amazon Bedrock AgentCore Payments and Google's UCP (Universal Commerce Protocol) represent the enterprise procurement angle. AgentCore provides managed wallet authorization, session spending limits, and explicit authorization flows — no open-ended agent access to funds. UCP addresses enterprise procurement reality: PO matching, three-way match, approval chains, and policy-based rail selection (route by amount, jurisdiction, category, frequency). Unified budget accounting prevents rail-hopping budget circumvention. Stablecoin settlement offers finality — instant, irreversible, chargeback-free — which matters for agent-to-agent transactions where chargeback fraud would be catastrophic.

The liability gap is the deepest open problem. Current AaaS (Agent-as-a-Service) agreements apply SaaS-style liability caps — 12 months of fees — to deployments where a single agent workflow error could cause losses orders of magnitude larger. The Clifford Chance Agentic AI Framework identifies five contractual areas requiring revision: scope of authority (what can the agent do without pre-approval?), outcome-based SLAs (measuring performance by business outcomes, not uptime), expanded indemnification (covering content infringement, regulatory penalties, third-party claims), audit rights (entitlement to inspect agent logs and decision traces), and carve-outs (excluding customer misconfiguration and out-of-scope instructions). The industry is moving toward risk-sharing models — outcome-linked fees, insurance co-requirements, indemnification for verifiable hallucination-induced harm — but contractual standards remain unsettled.

Marketplace economics compounds the trust problem. Two-sided markets need both supply (capability providers) and demand (capability consumers) to reach critical mass, but neither side joins without trust. Providers won't publish agents without liability protection and clear revenue attribution. Consumers won't subscribe without audit trails and spending controls. Transaction cost economics applies: when does it make sense to build an agent capability in-house versus buying it from the marketplace? The answer depends on trust infrastructure — provenance tracking, reputation systems, and enforcement mechanisms that reduce the transaction cost of cross-organizational agent commerce.

Here's the concession: trust infrastructure is necessary but not sufficient. A marketplace with perfect trust and zero agents is worthless. Catalog size matters for discovery and long-tail coverage. But in the early years of agent marketplaces — the next 3–5 years, while the commercial and legal frameworks are still being written — the binding constraint is trust, not selection. Enterprises won't deploy agents that can spend money without audit trails. Consumers won't subscribe to agents that can't prove they're acting on delegated authority. The winners will be the platforms that make trust invisible — cryptographic mandates, scoped credentials, and non-repudiable audit trails that work so well users forget they're there. Catalog size wins the mature market. Trust infrastructure wins the right to compete in it.